NetFlow and sFlow Configuration Guide on Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

NetFlow and sFlow Configuration Guide on Cisco 8000 Series Routers, Cisco IOS XR Releases

Key components of NetFlow and sFlow

Updated: June 9, 2026

Want to summarize with AI?

Log in

Lists the main NetFlow and sFlow components used to capture, export, collect, analyze, and manage data.

Lists the main NetFlow and sFlow components used to capture, export, collect, analyze, and manage data.

The following NetFlow and sFlow components help you capture, export, collect, analyze, and manage data:

  • Exporter: Generates flow records and sends them to a collector.

  • Collector: Receives flow records from exporters and stores them for analysis.

  • Analyzer: Processes and interprets collected flow data to provide insights and reports.

  • Agent: Embedded in network devices to monitor and sample traffic (primarily for sFlow).

  • Manager: Provides configuration and management functions for exporters, collectors, and analyzers.

Flow exporter details

Flow exporters collect data about network flows and send flow records to a designated collector. This section provides details about their functions and configuration limits.

Flow exporters are device components that collect and export network flow data. The following list describes their main attributes:

  • A flow exporter, also known as an exporter map, collects data about network flows and sends flow records to a designated collector.

  • The exporter inspects packets, identifies flows, and exports flow-related data. Each exporter map can transmit flow reports to a single destination, and up to eight exporters are allowed per MAP configuration.

  • The flow exporter contains network specifications and transport layer attributes for the packets it exports. These packets are sent to the collector using the User Datagram Protocol (UDP). If the source interface does not have an assigned IP address, the packet exporter remains inactive.

Flow monitor

Flow monitors facilitate active traffic monitoring on interfaces by collecting and exporting traffic data using flow record and exporter maps.

A flow monitor is a network monitoring component that:

  • facilitates active traffic monitoring on a pre-configured interface,

  • generates a flow monitor cache to collect traffic data based on key and non-key fields in the configured record, and

  • links to flow record maps and flow exporter maps for comprehensive data collection and export.

You can include extended details in a flow monitor, such as router-specific elements like nexthop, source and destination mask lengths, and extended gateway attributes, including nexthop, communities, local preference, and AS (source AS, source peer AS, and destination AS path) information.

A monitor map contains name references that link to the flow record map and flow exporter map, both of which are committed to an interface. If an exporter map is not applied to the monitor map, the flow records are not exported. In such cases, the aging process adheres to the cache parameters specified in the monitor map.

Flow sampler configuration parameters

This reference lists the configuration parameters and important considerations for flow sampler maps, including supported sampling rates and usage guidelines for high-speed interfaces.

The sampler map specifies the rate at which packets (one out of n packets) are sampled. The sampler map configuration is typically used for high-speed interfaces to optimize CPU utilization. Set the sampling rate after evaluating network parameters such as traffic rate, number of total flows, cache size, and active and inactive timers.

  • The maximum supported sampling rate is 1:1, where every packet is processed.

Consider these points before applying the sampler map:

  • Remove any existing Netflow or sFlow configurations before applying a new sampler map on an interface.

  • Use the same sampler map configuration on the sub-interfaces and physical interfaces under a port.